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Top Stories 

• A January 7 fire at an Appalachian Forest Products lumber plant in Mosheim, Tennessee, 
consumed 2 buildings and prompted the evacuation of 3 Greene County schools due to 
concerns of a chemical release. - WJHL 11 Johnson City (See item 10 ) 

• A gunman died from a self-inflicted gunshot wound after fatally shooting a doctor at the El 
Paso VA Health Care System clinic in west Texas January 6. - USA Today (See item 16 ) 

• Over 300 vehicle crashes, including 30 involving school buses, were reported in Virginia 
January 6 following a winter storm that dumped several inches of snow on untreated roads. 
- InsideNova.com (See item ^) 

• Authorities are investigating after an improvised explosive device detonated against the 
building that houses the office for the Colorado Springs, Colorado chapter of the National 
Association for the Advancement of Colored People (NAACP) January 6. - Denver Post 
(See item 27) 
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Energy Sector 



Nothing to report 



[ Return to top] 

Chemical Industry Sector 

1. January 6, U.S. Department of Labor - (Illinois) Chemical cleanup workers still 
exposed to dangerous hazards. The Occupational Safety and Health Administration 
cited Dedicated TCS LLC January 6 for 7 repeat and 2 serious safety violations at the 
company’s chemical ta nk cleaning site in Channahon following a July 2014 inspection 
that revealed worker exposures to dangerous confined space hazards. Proposed 
penalties total $79,464. 

Source: 

https://www.osha.gov/pls/oshaweb/owadisp.show document?p table=NEWS RELEA 
SES&p id=27216 

2. January 6, U.S. Department of Labor - (Georgia) OSHA cites MFG Chemical Inc. 
for repeated safety hazards after 2 workers injured, 1 fatally. MFG Chemical Inc., 
was fined $87,780 and cited for 17 safety and health violations following a July 2014 
inspection of the company’s facility in Dalton by the Occupational Safety and Health 
Administration. The investigation was initiated following a chemical release from an 
overpressurized reactor that resulted in the death of one worker and the injury of a 
second worker. 

Source: 

https://www.osha.gov/pls/oshaweb/owadisp.show document?p table=NEWS RELEA 
SES&p id=27213 

[ Return to top ] 

Nuclear Reactors, Materials, and Waste Sector 

Nothing to report 
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Critical Manufacturing Sector 

3. January 6, CNNMoney - (National) Ford recalls SUVs because drivers are 
accidentally turning them off. Ford announced that it is recalling around 13,500 
model year 2015 Lincoln MKC vehicles due to the potential of drivers mistakenly 
pressing the push-button ignition and turning the vehicle off while accessing other 
buttons on a transmission and entertainment panel. 

Source: http://monev.cnn.eom/2015/01/06/autos/ford-push-button-ignition-recall/ 

[ Return to top ] 
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Defense Industrial Base Sector 



Nothing to report 
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Financial Services Sector 

4. January 7, Newnan Times-Herald - (Georgia) Forged gift card arrest made in 
Grantville. Police in Grantville arrested a man after a search during a traffic stop 
yielded 210 fraudulent gift cards and other items January 4. Police believe that there 
may be a connection between the man and three others arrested the week of December 
28 due to the same types of forged cards and cartons of cigarettes in their possession. 
Source: http://www.times-herald.com/Local/20140107-forged-gift-card-arrest 

5. January 7, Securityweek - (International) New Emotet variant targets banking 
credentials of German speakers. Researchers with Microsoft identified a new variant 
of the Emotet banking malware dubbed Trojan:Win32/Emotet.C which was first seen 
in November and currently targets German-speaking individuals in several European 
countries. The malware is capable of stealing online banking login information as well 
as login information for email and messaging services. 

Source: http://www.securitvweek.com/new-emotet-variant-targets-banking-credentials- 
german-speakers 

6. January 6, Krebs on Security — (International) Thieves jackpot ATMs with ‘Black 
Box’ attack. Researchers with NCR analyzed an attack on an ATM utilizing USB 
devices and physical access to disconnect an ATM from its computer and issue remote 
commands to the cash dispenser. The attack used a smartphone to issue commands 
from a remote attacker through a dynamic IP service, and a second USB device 
designed to trick the ATM into thinking it was still connected to its original computer. 
Source: https://krebsonsecuritv.eom/2015/01/thieves-iackpot-atms-with-black-box- 
attack/ 

[ Return to top ] 

Transportation Systems Sector 

7. January 6, Associated Press; KCBS 2 Los Angeles - (San Erancisco) Bay Area 
freeway reopens after man talked off overpass. California Highway Patrol closed 
Interstate 280 at U.S. Highway lOI in San Erancisco for more than 6 hours January 6 
while officers negotiated down a man who was standing on the overpass. The man was 
taken into custody and all southbound lanes reopened. 

Source: http://www.pressdemocrat.com/news/3341229-181/bav-area-freeway-reopens- 
after 

8. January 6, Greene County Daily World - (Indiana) U.S. Highway 41 partially closed 
due to train-truck collision. A collision between a semi-truck and a railroad train 
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closed portions of U.S. Highway 41 north of Shelburn for approximately 2 hours 
January 6. The Sullivan County Sherriff s Department responded to the scene and three 
non-life-threatening injuries were reported. 

Source: http://www.gcdailvworld.com/storv/2153480.html 

9. January 6, USA Today - (National) Tuesday flight cancellations top 930 as cold 
moves in. More than 930 flights were canceled at several major airports in the Mid- 
Atlantic and Midwest regions of the country due to a cold front January 6. 

Source: http://www.usatodav.eom/storv/todavintheskv/2015/01/06/trouble-spots-loom- 
for-tuesdav-fliers-as-cold-moves-in/2 13277 17/ 



For another story, see item 20 
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Food and Agriculture Sector 

10. January 7, WJHL 11 Johnson City - (Tennessee) Crews battle fire at Mosheim 
lumber facility; nearby students bused to other schools. A January 7 fire at an 
Appalachian Forest Products lumber plant in Mosheim consumed two buildings and 
prompted a HAZMAT team response due to concerns of a chemical release caused by 
explosive chemicals at the wood chopping business. Three Greene County schools 
were evacuated and students were relocated to another school as a precaution while 
crews responded to the blaze. 

Source: http://www.wihl.com/storv/27780382/multiple-units-called-in-to-battle-fire-at- 
mosheim-lumber-company 

1 1 . January 6, WNEM 5 Bay City — (Michigan) 540 infected trees scheduled to be cut 
down at state park. Crews began January 7 the process of cutting down and removing 
540 trees that are dying due to an infestation of the invasive emerald ash borer insect 
from the Bay City State Recreation park in Bay County. 

Source: http://www.wnem.com/storv/27776393/540-infected-trees-scheduled-to-be- 
cut-down-at-state-park 

12. January 6, U.S. Department of Labor - (Florida) Temporary worker suffers 
permanent disability after packaging machine crushes him. The Occupational 
Safety and Health Administration cited Ice River Springs January 6 for 3 safety 
violations after a temporary worker suffered permanent disability while clearing a 
jammed packaging machine at the water-bottle manufacturer’s facility in High Springs, 
Florida. Proposed penalties total $84,000. 

Source: 

https://www.osha.gov/pls/oshaweb/owadisp.show document?p table=NEWS RELEA 
SES&p id=27207 



13. January 6, U.S. Food and Drug Administration - (National) Whole Foods Market 
voluntarily recalls Assorted Cookie Platters sold in Arizona, southern California, 
Hawaii and Nevada due to undeclared nut allergens. The U.S. Food and Drug 
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Administration reported January 5 that Whole Foods Market recalled all sizes of its 
Assorted Cookie Platters sold at the company’s stores in Arizona, southern California, 
Hawaii, and Nevada, beginning November 24 due to undeclared nut allergens. One 
illness was reported in connection with the mislabeling issue and the company has 
removed the affected product from the stores’ shelves. 

Source: http ://w w w . fda. gov/S afetv/Recalls/ucm429 172 .htm 
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Water and Wastewater Systems Sector 

14. January 6, KSWB 69 San Diego - (California) Sewage spill pollutes Carlsbad beach. 
A gate valve failed to close at a treatment plant in Carlsbad January 6 causing 
wastewater to overflow, spilling 125 gallons of sewage into Encina Creek which 
empties into the Carlsbad State Beach area. Pollution hazard signs will stand around the 
creek until tests deem area safe for recreational use. 

Source: http://fox5sandiego.eom/2015/01/06/sewage-spill-pollutes-ocean-near- 
carlsbad/ 

15. January 6, Richmond Palladium-Item - (Indiana) Boil advisory issued for Mount 
Auburn. The Cambridge City Water Department ordered a precautionary boil advisory 
January 6 for Mount Auburn until January 8 after water pressure fell overnight January 
5. 

Source: http://www.pal-item.eom/storv/news/local/2015/01/06/boil-advisorv-issued- 
mount-auburn/2 1335257/ 
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Healthcare and Public Health Sector 

16. January 7, USA Today - (Texas) Gunman, one other dead after El Paso VA 
shooting. A gunman died from a self-inflicted gunshot wound after shooting and 
killing a doctor at the El Paso VA Health Care System clinic in west Texas January 6. 
Police secured the scene and the clinic will remain closed January 7. 

Source: http://www.usatodav.eom/storv/news/nation/2015/01/06/active-shooter- 
reported-at-el-paso-military-hospital/2 1358703/ 



[ Return to top ] 



Government Facilities Sector 

17. January 6, KNTV 11 San Jose - (California) 3 San Carlos schools closed due to 
water main break. Tierra Einda Middle School, Charter Eearning Center, and Edison 
Montessori School in San Carlos were forced to close January 6 due to a water main 
break that cut off water service. 

Source: http://www.nbcbavarea.com/news/local/Tierra-Einda-Middle-3-San-Carlos- 
Schools-Closed-Due-to-Water-Main-Break-28765435 1 .html 
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18. January 6, Seaside CoMrzer - (California) Carlsbad High to reopen Wednesday 
following online threat. Carlsbad High School and Carlsbad Village Academy in 
California will resume classes January 7 after a hoax bomb threat made on social media 
prompted officials to evacuate students January 5 and cancel classes January 6. 

Source: http://www.seasidecourier.com/news/carlsbad-high-to-reopen-wednesday- 
following-online-threat/article 028aa8fa-95e0-lle4-a5ef-13al2c7808f9.html 

19. January 6, Associated Press - (New York) 1 dead, kids hurt after school buses 
collide in Rochester. The bus driver of a Dr. Martin Luther King Jr. School No. 9 bus 
suffered an apparent heart attack before the vehicle crashed into another school bus and 
a tree in Rochester January 6, leaving 8 students and 1 other adult injured. 

Source: http://www.lohud.eom/storv/news/local/new-vork/2015/01/06/dead-kids-hurt- 
school-buses-collide-rochester/2 1356815/ 

20. January 6, InsideNova.com - (Virginia) Dozens of school buses involved in crashes 
Tuesday morning. Over 300 vehicle crashes, including 30 involving school buses, 
were reported in Virginia January 6 following a winter storm that dumped several 
inches of snow on untreated roads. A number of counties also cancelled classes or 
issued delays for students. 

Source: http://www.insidenova.com/headlines/maior-school-districts-open-on-time- 
during-snow-lawmaker-calls/article 204ac052-95b6-lle4-8dd9-73640a723ffc.html 

For additional stories, see items W and 11 
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Emergency Services Sector 

See item 25 



[ Return to top ] 

Information Technology Sector 

21. January 7, Help Net Security - (International) HuffPo visitors targeted with 
malvertising, infected with ransomware. Cyphort Lab researchers identified a 
malvertising campaign that placed malicious ads on the Web sites of the Huffington Post 
and Gamezone.com by abusing the advertising.com ad network. The campaign began 
December 3 1 and used the Neutrino or Sweet Orange exploit kits to attempt to serve the 
Kovter ransomware. 

Source: http://www.net-securitv.org/malware news.php?id=2936 

22. January 7, Securityweek - (International) CryptoWall 2.0 ransomware capable of 
executing 64-bit code: Cisco. Researchers with Cisco’s Talos Group published an 
analysis of the CryptoWall 2.0 ransomware and found that it contains several anti- 
sandbox and anti-security features, as well as the ability to run 64-bit code from a 32- 
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bit dropper, among other findings. 

Source: http://www.securitvweek.com/crvptowall-20-ransomware-capable-executing- 
64-bit-code-cisco 



23. January 6, Securityweek - (International) Wi-Fi password phishing attacks 

automated with new tool. A researcher released a tool dubbed Wifiphisher that can 
automate WiFi network password phishing by deauthenticating users, setting up a 
matching rogue access point using the target’s settings, and the performing a man-in- 
the-middle (MitM) attack using a fake firmware update notification. 

Source: http://www.securitvweek.com/wi-fi-password-phishing-attacks-automated- 
new-tool 



24. January 6, Softpedia - (International) Microsoft warns of malicious macros targeting 
users in the UK and the US. Microsoft stated that it has observed two pieces of 
malware being spread via malicious emails that attempts to get users to enable macros 
in Microsoft Office programs in order to infect computers. The campaigns attempt to 
distribute the Adnel and Tarbir malware and have primarily targeted users in the U.S. 
and U.K. 

Source: http://news.softpedia.com/news/Microsoft-Warns-of-Malicious-Macros- 
Targeting-Users-in-the-UK-and-the-US-469139.shtml 

For another story, see item 5 



Internet Alert Dashboard 



To report cyber infrastructure incidents or to request information, please contact US-CERT at soc@us-cert.gov or 
visit their Web site: httD://www.us-cert.gov 

Information on IT information sharing and analysis can be found at the IT ISAC (Information Sharing and 
Analysis Center) Web site: http://www.it-isac.org 
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Communications Sector 

25. January 6, iFIBER ONE News - (Washington) Wilson Creek lost phone service after 
rodents chewed through line. CenturyLink reported that 222 lines were cut and 9-1-1 
service in Wilson Creek was lost January 5 due to rodents chewing on fiber optic cable. 
Service was restored January 6. 

Source: http://www.ifiberone.com/news/wilson-creek-lost-phone-service-after-rodents- 
chewed-through- line/article 06a548ea-95el- 1 Ie4-b46d-9f5a33d0ce5d.html 

26. January 6, WKRK 1320 AM Murphy - (North Carolina) Copper thieves to blame for 
recent telephone interruption. Copper cables were stolen from Frontier 
Communications in Nantahala January 2 and Needmore December 30, disrupting 
communication services. Frontier Communications is working with law enforcement 
and scrap metal dealers to identify the culprits. 

Source: http://www.1320am.com/copper-thieves-to-blame-for-recent-telephone- 
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interruption/ 
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Commercial Facilities Sector 

27. January 7, Denver Post - (Colorado) "Improvised explosive device" set off near 
Colorado Springs NAACP office. Authorities are investigating after an improvised 
explosive deviee detonated against the building that houses the offiee for the Colorado 
Springs ehapter of the National Assoeiation for the Advaneement of Colored People 
(NAACP) January 6. Poliee are searching for a potential person of interest and are 
examining evidence from the scene. 

Source: http://www.denverpost.com/news/ci 27267521/colorado-springs-police- 
responding-explosion-reports-at-naacp 

28. January 7, Hartford CoMrant - (Connecticut) Hartford fire displaces 25; more than 
six rescued. Five residents were injured and 25 others were displaced from 17 units at 
a Hartford apartment building January 7 after a fire consumed one floor of the 
structure. Firefighters rescued at least 6 residents from the burning building, and the 
cause of the blaze is under investigation. 

Source: http://www.courant.eom/breaking-news/hc-hartford-fire-0108-20150107- 
story.html 

29. January 6, WNEP 16 Scranton - (Pennsylvania) Taylor homes evacuated for gas 
leak. More than 100 residents were evacuated from a housing complex in Taylor due to 
a nearby gas leak caused by a broken fuel pipe January 6. Utility crews continued to 
work January 7 to cap the leak before residents could return to the housing complex. 
Source: http://wnep.eom/2015/01/06/tavlor-homes-evacuated-for-gas-leak/ 
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Dams Sector 



Nothing to report 
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Department of Homeland Security (DHS) 

DHS Daily Open Source Infrastructure Report Contact Information 



About the reports - The DHS Daily Open Source Infrastructure Report is a daily [Monday thi'ough Friday] 
summary of open-source published information concerning significant critical infrastructure issues. The DHS Daily 
Open Source Infrastructure Report is archived for 10 days on the Department of Homeland Security Web site: 
http://www.dhs.gov/IPDailvReport 

Contact Information 

Content and Suggestions: Send mail to cikr.productfeedback@hq.dhs.gov or contact the DHS 

Daily Report Team at (703) 942-8590 

Subscribe to the Distribution List: Visit the DHS Daily Open Source Infrastructure Report and follow 

instructions to Get e-mail updates when this information changes . 

Removal from Distribution List: Send mail to support® govdeliverv.com . 



Contact DHS 

To report physical infrastructure incidents or to request information, please contact the National Infrastructure 
Coordinating Center at nicc@hq.dhs.gov or (202) 282-9201. 

To report cyber infrastructure incidents or to request information, please contact US -CERT at soc@us-cert.gov or visit 
their Web page at www.us-cert.gov . 

Department of Homeland Security Disclaimer 

The DHS Daily Open Source Infrastructure Report is a non-commercial publication intended to educate and inform 
personnel engaged in infrastructure protection. Further reproduction or redistribution is subject to original copyright 
restrictions. DHS provides no warranty of ownership of the copyright, or accuracy with respect to the original source 
material. 
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